@sebastienrousseau/dotfiles 0.2.499 → 0.2.500

package/scripts/release/package-policy-bundles.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+## Package tracked governance artifacts into a release bundle.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="${REPO_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+
+OUTPUT_DIR="${OUTPUT_DIR:-$REPO_ROOT/dist/policy-bundles}"
+BUNDLE_VERSION="${BUNDLE_VERSION:-$(jq -r '.schemaVersion' "$REPO_ROOT/dot_config/dotfiles/policy-bundles.json")}"
+JSON_MODE=0
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --output-dir | -o)
+      OUTPUT_DIR="${2:-}"
+      shift 2
+      ;;
+    --version | -v)
+      BUNDLE_VERSION="${2:-}"
+      shift 2
+      ;;
+    --json | -j)
+      JSON_MODE=1
+      shift
+      ;;
+    *)
+      shift
+      ;;
+  esac
+done
+
+command -v jq >/dev/null 2>&1 || {
+  echo "jq is required for policy bundle packaging." >&2
+  exit 1
+}
+
+bundle_root="$OUTPUT_DIR/policy-bundles-$BUNDLE_VERSION"
+archive_file="$OUTPUT_DIR/policy-bundles-$BUNDLE_VERSION.tar.gz"
+checksum_file="$OUTPUT_DIR/policy-bundles-$BUNDLE_VERSION.sha256"
+
+rm -rf "$bundle_root"
+mkdir -p "$bundle_root/dot_config/dotfiles" "$bundle_root/.well-known" "$bundle_root/docs/security" "$bundle_root/docs/operations" "$bundle_root/docs/interop"
+
+files=(
+  "dot_config/dotfiles/policy-bundles.json"
+  "dot_config/dotfiles/model-registry.json"
+  "dot_config/dotfiles/prompt-registry.json"
+  "dot_config/dotfiles/agent-profiles.json"
+  "dot_config/dotfiles/agent-card.json"
+  "dot_config/dotfiles/mcp-policy.json"
+  "dot_config/dotfiles/mcp-registry.json"
+  "dot_config/dotfiles/mcp-lock.json"
+  ".well-known/agent.json"
+  ".well-known/agent-card.json"
+  ".well-known/mcp/server-card.json"
+  "docs/security/MCP_POLICY.md"
+  "docs/operations/TRUSTED_AGENT_WORKSTATION.md"
+  "docs/interop/A2A.md"
+)
+
+for file in "${files[@]}"; do
+  [[ -f "$REPO_ROOT/$file" ]] || {
+    echo "Missing required policy bundle artifact: $file" >&2
+    exit 1
+  }
+  mkdir -p "$bundle_root/$(dirname "$file")"
+  cp "$REPO_ROOT/$file" "$bundle_root/$file"
+done
+
+jq empty "$bundle_root/dot_config/dotfiles/policy-bundles.json" >/dev/null
+jq empty "$bundle_root/dot_config/dotfiles/model-registry.json" >/dev/null
+jq empty "$bundle_root/dot_config/dotfiles/prompt-registry.json" >/dev/null
+jq empty "$bundle_root/dot_config/dotfiles/agent-profiles.json" >/dev/null
+jq empty "$bundle_root/dot_config/dotfiles/agent-card.json" >/dev/null
+jq empty "$bundle_root/dot_config/dotfiles/mcp-policy.json" >/dev/null
+jq empty "$bundle_root/dot_config/dotfiles/mcp-registry.json" >/dev/null
+jq empty "$bundle_root/dot_config/dotfiles/mcp-lock.json" >/dev/null
+jq empty "$bundle_root/.well-known/agent.json" >/dev/null
+
+tar -C "$OUTPUT_DIR" -czf "$archive_file" "policy-bundles-$BUNDLE_VERSION"
+sha256sum "$archive_file" >"$checksum_file"
+
+# Generate CycloneDX SBOM
+sbom_file="$bundle_root/sbom.cyclonedx.json"
+if command -v syft >/dev/null 2>&1; then
+  syft dir:"$bundle_root" -o cyclonedx-json >"$sbom_file" 2>/dev/null
+else
+  # Minimal CycloneDX manifest via jq
+  jq -n \
+    --arg version "$BUNDLE_VERSION" \
+    --arg timestamp "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+    '{
+      bomFormat: "CycloneDX",
+      specVersion: "1.5",
+      version: 1,
+      metadata: {
+        timestamp: $timestamp,
+        component: {
+          type: "application",
+          name: "dotfiles-policy-bundles",
+          version: $version
+        }
+      },
+      components: []
+    }' >"$sbom_file"
+fi
+
+# Re-create archive with SBOM included
+tar -C "$OUTPUT_DIR" -czf "$archive_file" "policy-bundles-$BUNDLE_VERSION"
+sha256sum "$archive_file" >"$checksum_file"
+
+if [[ "$JSON_MODE" -eq 1 ]]; then
+  jq -n \
+    --arg version "$BUNDLE_VERSION" \
+    --arg output_dir "$OUTPUT_DIR" \
+    --arg archive "$archive_file" \
+    --arg checksum "$checksum_file" \
+    --arg sbom "$sbom_file" \
+    '{version: $version, output_dir: $output_dir, archive: $archive, checksum: $checksum, sbom: $sbom}'
+else
+  printf 'Policy bundle archive: %s\n' "$archive_file"
+  printf 'Policy bundle checksum: %s\n' "$checksum_file"
+fi

package/scripts/secrets/age-init.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+set -euo pipefail
+
+SECRETS_DIR="$HOME/.config/chezmoi"
+KEY_FILE="$SECRETS_DIR/key.txt"
+CONFIG_FILE="$SECRETS_DIR/chezmoi.toml"
+
+mkdir -p "$SECRETS_DIR"
+
+if ! command -v age-keygen >/dev/null; then
+  echo "age-keygen not found. Install 'age' first." >&2
+  exit 1
+fi
+
+if [[ ! -f "$KEY_FILE" ]]; then
+  age-keygen -o "$KEY_FILE"
+  chmod 600 "$KEY_FILE"
+  echo "Age key created at $KEY_FILE"
+else
+  echo "Age key already exists: $KEY_FILE"
+fi
+
+recipient=$(age-keygen -y "$KEY_FILE")
+
+python3 - "$CONFIG_FILE" "$KEY_FILE" "$recipient" <<'PY'
+import sys
+import json
+from pathlib import Path
+
+config_path = Path(sys.argv[1])
+key_file = sys.argv[2]
+recipient = sys.argv[3]
+
+content = ""
+if config_path.exists():
+    content = config_path.read_text(encoding="utf-8")
+
+lines = content.splitlines()
+
+# Remove existing encryption/age block
+out = []
+in_age = False
+for line in lines:
+    if line.strip().startswith("[age]"):
+        in_age = True
+        continue
+    if in_age:
+        if line.strip().startswith("["):
+            in_age = False
+            out.append(line)
+        else:
+            continue
+    else:
+        if line.strip().startswith("encryption ="):
+            continue
+        out.append(line)
+
+# Append updated config (use json.dumps for safe string escaping)
+out.append("")
+out.append("encryption = \"age\"")
+out.append("")
+out.append("[age]")
+out.append(f"identity = {json.dumps(key_file)}")
+out.append(f"recipient = {json.dumps(recipient)}")
+
+config_path.write_text("\n".join(out).rstrip() + "\n", encoding="utf-8")
+PY
+
+echo "Updated $CONFIG_FILE with age encryption settings."

package/scripts/secrets/create-secrets-file.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+set -euo pipefail
+
+OUT_FILE="${1:-$HOME/.config/chezmoi/encrypted_secrets.env.age}"
+KEYRING_DIR="$HOME/.config/chezmoi"
+AGE_KEY="$KEYRING_DIR/key.txt"
+
+if [ ! -f "$AGE_KEY" ]; then
+  echo "Age identity not found: $AGE_KEY"
+  echo "Run: dot secrets-init"
+  exit 1
+fi
+
+if ! command -v age >/dev/null; then
+  echo "age not found. Install it first."
+  exit 1
+fi
+
+if [ -f "$OUT_FILE" ]; then
+  echo "Secrets file already exists: $OUT_FILE"
+  exit 0
+fi
+
+recipient="$(age-keygen -y "$AGE_KEY")"
+mkdir -p "$(dirname "$OUT_FILE")"
+
+tmp_secrets="$(umask 077 && mktemp)" || exit 1
+tmp_recipient="$(umask 077 && mktemp)" || exit 1
+trap 'rm -f "$tmp_secrets" "$tmp_recipient"' EXIT
+
+printf "%s\n" "# Add secrets as KEY=VALUE" "EXAMPLE_TOKEN=change_me" >"$tmp_secrets"
+printf "%s" "$recipient" >"$tmp_recipient"
+
+age -R "$tmp_recipient" -o "$OUT_FILE" "$tmp_secrets"
+
+chmod 600 "$OUT_FILE"
+
+cat <<MSG
+Created encrypted secrets file:
+  $OUT_FILE
+
+Edit it with:
+  dot secrets
+MSG

package/scripts/secrets/encrypt-ssh-key.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+set -euo pipefail
+
+KEY_PATH="${1:-$HOME/.ssh/id_ed25519}"
+OUT_FILE="${2:-$HOME/.config/chezmoi/encrypted_id_ed25519.age}"
+KEYRING_DIR="$HOME/.config/chezmoi"
+AGE_KEY="$KEYRING_DIR/key.txt"
+
+if [ ! -f "$KEY_PATH" ]; then
+  echo "SSH key not found: $KEY_PATH"
+  exit 1
+fi
+
+if [ ! -f "$AGE_KEY" ]; then
+  echo "Age identity not found: $AGE_KEY"
+  echo "Run: dot secrets-init"
+  exit 1
+fi
+
+if ! command -v age >/dev/null; then
+  echo "age not found. Install it first."
+  exit 1
+fi
+
+recipient="$(age-keygen -y "$AGE_KEY")"
+mkdir -p "$(dirname "$OUT_FILE")"
+
+if [ -f "$OUT_FILE" ]; then
+  echo "Encrypted file already exists: $OUT_FILE"
+  exit 0
+fi
+
+age -R <(printf "%s" "$recipient") -o "$OUT_FILE" "$KEY_PATH"
+chmod 600 "$OUT_FILE"
+
+cat <<MSG
+Encrypted SSH key written to:
+  $OUT_FILE
+
+This file is local only. If you want to track it in dotfiles, run:
+  chezmoi add --encrypt $OUT_FILE
+MSG

package/scripts/security/backup.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+## Create compressed backup of home directory.
+##
+## Archives the home directory (excluding cache and trash) to a timestamped
+# shellcheck disable=SC1091
+## .tgz file. Supports custom source and destination directories via
+## environment variables.
+##
+## # Usage
+## dot backup
+## DOTFILES_BACKUP_DIR=/mnt/backup dot backup
+##
+## # Dependencies
+## - tar: Archive creation
+##
+## # Environment Variables
+## | Variable | Default | Description |
+## |----------|---------|-------------|
+## | DOTFILES_BACKUP_DIR | ~/.backups | Backup destination |
+## | DOTFILES_BACKUP_SRC | ~/ | Source directory |
+##
+## # Platform Notes
+## - macOS: Uses BSD tar
+## - Linux: Uses GNU tar
+## - WSL: Backup stored in Linux filesystem for performance
+##
+## # Security
+## Does not encrypt backups. Use age/gpg for sensitive data.
+##
+## # Idempotency
+## Creates new timestamped backup on each run.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+
+ui_init
+ui_header "Backup"
+
+BACKUP_DIR="${DOTFILES_BACKUP_DIR:-$HOME/.backups}"
+SRC_DIR="${DOTFILES_BACKUP_SRC:-$HOME}"
+STAMP=$(date +%Y%m%d-%H%M%S)
+OUT="$BACKUP_DIR/dotfiles-backup-$STAMP.tgz"
+
+mkdir -p "$BACKUP_DIR"
+
+if ! tar --exclude="$HOME/.cache" --exclude="$HOME/.local/share/Trash" -czf "$OUT" "$SRC_DIR"; then
+  ui_err "Backup failed"
+  rm -f "$OUT"
+  exit 1
+fi
+
+ui_ok "Backup written" "$OUT"

package/scripts/security/dns-doh.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+# shellcheck source=../dot/lib/platform.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/platform.sh"
+
+DRY_RUN=0
+for arg in "$@"; do
+  case "$arg" in --dry-run | -n) DRY_RUN=1 ;; esac
+done
+_run_cmd() {
+  if [[ "$DRY_RUN" -eq 1 ]]; then ui_info "[dry-run]" "$*"; else "$@"; fi
+}
+
+ui_init
+ui_header "DNS-over-HTTPS"
+
+if [[ "$DRY_RUN" -eq 1 ]]; then
+  ui_info "Mode" "dry-run (no changes will be made)"
+elif [ "${DOTFILES_DOH:-}" != "1" ]; then
+  ui_warn "DoH" "disabled by default"
+  ui_info "Re-run" "DOTFILES_DOH=1"
+  exit 1
+fi
+
+case "$(dot_platform_id)" in
+  linux | wsl)
+    if command -v resolvectl >/dev/null; then
+      ui_info "Enabling" "systemd-resolved DoH (Cloudflare)"
+      _run_cmd sudo resolvectl dns-over-https on
+      _run_cmd sudo resolvectl dns 1.1.1.1 1.0.0.1
+    else
+      ui_err "systemd-resolved" "not detected"
+      exit 1
+    fi
+    ;;
+  macos)
+    ui_info "Configure" "DoH in your browser"
+    exit 0
+    ;;
+  *)
+    ui_err "Unsupported OS" "DoH config"
+    exit 1
+    ;;
+esac

package/scripts/security/encryption-check.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+# shellcheck source=../dot/lib/platform.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/platform.sh"
+
+ui_init
+ui_header "Encryption Check"
+
+case "$(dot_platform_id)" in
+  macos)
+    if command -v fdesetup >/dev/null; then
+      status=$(fdesetup status || true)
+      echo "$status"
+      echo "$status" | grep -qi "FileVault is On" && {
+        ui_ok "FileVault" "On"
+        exit 0
+      }
+      ui_warn "FileVault" "appears to be off"
+      exit 1
+    else
+      ui_err "fdesetup" "not found"
+      exit 1
+    fi
+    ;;
+  linux | wsl)
+    if command -v lsblk >/dev/null; then
+      lsblk_output=$(lsblk -f)
+      if command -v rg >/dev/null; then
+        if echo "$lsblk_output" | rg -i "crypto|luks" >/dev/null; then
+          ui_ok "LUKS" "encrypted block device detected"
+          exit 0
+        fi
+      else
+        if echo "$lsblk_output" | grep -Ei "crypto|luks" >/dev/null; then
+          ui_ok "LUKS" "encrypted block device detected"
+          exit 0
+        fi
+      fi
+      ui_warn "LUKS" "no crypto volume detected"
+      exit 1
+    fi
+    ;;
+  *)
+    ui_err "Unsupported OS" "encryption check"
+    exit 1
+    ;;
+esac